A help desk technician receives a call from a user who states they clicked on a link in an email that appeared to be from the company's CEO requesting urgent action. The user entered their username and password on the resulting webpage. Which of the following is the FIRST step the technician should take according to incident response procedures?

Notify the user's manager

Notification is important but should occur after immediate containment steps to prevent further unauthorized access.

Run an antivirus scan

While scanning for malware may be necessary later, the immediate threat is the compromised credential, not necessarily malware. Containment should come first.

Block the CEO's email address

Blocking the sender's address is a reactive measure and does not protect the compromised user account. The attacker may use other addresses or methods.

What does this 220-1102 question test?

Read the scenario before looking for a memorised answer.

What is the correct answer to this question?

The correct answer is: Reset the user's password and revoke tokens — When a user's credentials have been compromised, the immediate priority is to contain the breach by resetting the user's password and revoking any authentication tokens or active sessions. This prevents the attacker from using the stolen credentials to access systems. Notifying the manager is important but should follow containment. Running an antivirus scan may be warranted, but securing the account takes precedence. Blocking the sender's email address is a reactive measure and does not address the compromised account.

What should I do if I get this 220-1102 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.